Hello,
I am trying to get data in using Splunk rest API feature of Splunk add-on builder, however I am not able to get the results using POST method.
Does anyone know what is the correct syntax to pass JSON query in REST request body?
I tried using "data","payload","raw" as Name and in Value I have put the JSON query but it's not working.
I keep getting The response status=500 for request ....
PS: I have used postman to validate my request body and it works fine and return results. however, I am not able to do that using Splunk rest API. Not sure if I am missing something.
I know this is an old post, but posting an answer in case others need it.
To translate the body { "key1":"value1", "key2": "value2", ...}
The AOB request body will be :
Name: key1 Value: value1
Name: key2 Value: value2
Name: ..... Value: .......
Also, I see you're using Basic Auth. I'd suggest using Global Account in Add-On Setup Parameters. It should have a checkbox for Basic Auth.